GH-49728: [CI] Set persist-credentials: false in checkout actions

.github/workflows/archery.yml

@@ -60,6 +60,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Git Fixup
         shell: bash

.github/workflows/check_labels.yml

@@ -48,6 +48,8 @@ jobs:
       - name: Checkout Arrow
         if: github.event_name == 'pull_request'
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Check
         id: check
         env:

.github/workflows/comment_bot.yml

@@ -38,6 +38,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           path: arrow
           # fetch the tags for version number generation
           fetch-depth: 0

.github/workflows/cpp.yml

@@ -112,6 +112,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
@@ -165,6 +166,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Check CMake presets
@@ -220,6 +222,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Install Dependencies
@@ -349,6 +352,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - uses: msys2/setup-msys2@v2

.github/workflows/cpp_extra.yml

@@ -139,6 +139,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
@@ -221,6 +222,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Free up disk space
@@ -273,6 +275,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Install dependencies
@@ -367,6 +370,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
@@ -431,6 +435,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Install Dependencies
@@ -552,6 +557,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Download Timezone Database
@@ -579,6 +585,7 @@ jobs:
       - name: Checkout vcpkg
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           path: vcpkg
           repository: microsoft/vcpkg
@@ -706,6 +713,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 1
           path: arrow
           repository: apache/arrow
@@ -736,6 +744,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Download the artifacts

.github/workflows/cpp_windows.yml

@@ -84,6 +84,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Install msys2 (for tzdata for ORC tests)

.github/workflows/cuda_extra.yml

@@ -85,6 +85,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes

.github/workflows/dev.yml

@@ -49,6 +49,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install pre-commit
         run: |
@@ -88,6 +89,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install Python
         uses: actions/setup-python@v6

.github/workflows/docs.yml

@@ -51,6 +51,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Free up disk space
         run: |

.github/workflows/docs_light.yml

@@ -52,6 +52,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Cache Docker Volumes
         uses: actions/cache@v5

.github/workflows/integration.yml

@@ -68,36 +68,43 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Checkout Arrow Rust
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: apache/arrow-rs
           path: rust
       - name: Checkout Arrow nanoarrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: apache/arrow-nanoarrow
           path: nanoarrow
       - name: Checkout Arrow Go
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: apache/arrow-go
           path: go
       - name: Checkout Arrow Java
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: apache/arrow-java
           path: java
       - name: Checkout Arrow JS
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: apache/arrow-js
           path: js
       - name: Checkout Arrow .NET
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: apache/arrow-dotnet
           path: dotnet
       - name: Free up disk space

.github/workflows/matlab.yml

@@ -53,6 +53,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install ninja-build
         run: sudo apt-get install ninja-build
@@ -101,6 +102,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install ninja-build
         run: brew install ninja
@@ -142,6 +144,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install MATLAB
         uses: matlab-actions/setup-matlab@a0180c939fb1a28de13f44f7b778b912384ced1f # v3.0.1

.github/workflows/package_linux.yml

@@ -117,6 +117,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Free up disk space

.github/workflows/python.yml

@@ -106,6 +106,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
@@ -185,6 +186,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Setup Python
@@ -266,6 +268,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Setup Python

.github/workflows/r.yml

@@ -80,6 +80,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Free up disk space
@@ -152,6 +153,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Setup Python
@@ -209,6 +211,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup ccache
         shell: bash
@@ -266,6 +269,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       # This must be done before r-lib/actions/setup-r because curl in
       # Rtools doesn't work on non Rtools' MSYS2 environment. If we

.github/workflows/r_extra.yml

@@ -160,6 +160,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes

.github/workflows/r_nightly.yml

@@ -47,6 +47,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 1
           path: arrow
           repository: apache/arrow
@@ -55,6 +56,7 @@ jobs:
       - name: Checkout Crossbow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           path: crossbow
           repository: ursacomputing/crossbow

.github/workflows/release_candidate.yml

@@ -46,6 +46,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install dependencies
         run: |

.github/workflows/report_ci.yml

@@ -36,6 +36,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup Python
         uses: actions/setup-python@v6

.github/workflows/ruby.yml

@@ -83,6 +83,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
@@ -152,6 +153,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Install Homebrew Dependencies
@@ -250,6 +252,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Setup Ruby
@@ -368,6 +371,7 @@ jobs:
       - name: Checkout Arrow
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: recursive
       - name: Install meson
@@ -398,6 +402,7 @@ jobs:
       - name: Checkout vcpkg
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           path: vcpkg
           repository: microsoft/vcpkg